84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845ac

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe
Size 468KB
Sample240927-whreeswanf
SHA256 84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845ac
MD5 8f6d8dc4c543d65beeccf34d8dece870
SHA1 28c40caaafb8f256ed7c6ba072b48785356f207b
SHA512 9eaaf4effe7ecc526ad135d1bf7a364cc718de94b8ef75cfa6251946885ec49769821a9897bc6f83ba0ee356dcbb40e801323d89e0480b8335f98d16f0a2b874
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH04VPTwapkiC8zdsef:1bJo3gUr4Hkjrfkj+kwaeJ8zd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2768	Unicorn-25774.exe
1400	Unicorn-48654.exe
4076	Unicorn-20620.exe
3708	Unicorn-42982.exe
2816	Unicorn-34814.exe
5044	Unicorn-14948.exe
1456	Unicorn-20515.exe
904	Unicorn-42318.exe
3020	Unicorn-19851.exe
1612	Unicorn-12961.exe
2704	Unicorn-8612.exe
3480	Unicorn-709.exe
2544	Unicorn-709.exe
3680	Unicorn-34128.exe
1036	Unicorn-34128.exe
4300	Unicorn-4165.exe
4736	Unicorn-33500.exe
1100	Unicorn-41114.exe
3932	Unicorn-16344.exe
4552	Unicorn-57642.exe
1088	Unicorn-57642.exe
4336	Unicorn-45390.exe
3628	Unicorn-45390.exe
5012	Unicorn-21440.exe
1404	Unicorn-41306.exe
2964	Unicorn-31091.exe
1296	Unicorn-20123.exe
972	Unicorn-5104.exe
1640	Unicorn-18839.exe
4172	Unicorn-23708.exe
3952	Unicorn-8855.exe
4960	Unicorn-1965.exe
2376	Unicorn-6796.exe
2644	Unicorn-19646.exe
4372	Unicorn-51748.exe
3004	Unicorn-60102.exe
4964	Unicorn-43766.exe
5004	Unicorn-31514.exe
4688	Unicorn-4963.exe
1112	Unicorn-48597.exe
3356	Unicorn-32260.exe
1216	Unicorn-35790.exe
4608	Unicorn-23538.exe
4836	Unicorn-23538.exe
212	Unicorn-11285.exe
4156	Unicorn-57170.exe
392	Unicorn-33220.exe
1004	Unicorn-33220.exe
412	Unicorn-28582.exe
3652	Unicorn-18367.exe
2236	Unicorn-61181.exe
368	Unicorn-41580.exe
1188	Unicorn-27812.exe
3816	Unicorn-53013.exe
1832	Unicorn-53278.exe
1844	Unicorn-29328.exe
928	Unicorn-34895.exe
2204	Unicorn-4269.exe
3804	Unicorn-51424.exe
3860	Unicorn-25074.exe
4548	Unicorn-1337.exe
3668	Unicorn-47009.exe
1412	Unicorn-44408.exe
2536	Unicorn-50538.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4724	412	WerFault.exe	137
5420	412	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34890.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7724	dwm.exe
Token: SeChangeNotifyPrivilege	7724	dwm.exe
Token: 33	7724	dwm.exe
Token: SeIncBasePriorityPrivilege	7724	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe
2768	Unicorn-25774.exe
1400	Unicorn-48654.exe
4076	Unicorn-20620.exe
3708	Unicorn-42982.exe
5044	Unicorn-14948.exe
1456	Unicorn-20515.exe
2816	Unicorn-34814.exe
904	Unicorn-42318.exe
3020	Unicorn-19851.exe
1612	Unicorn-12961.exe
2704	Unicorn-8612.exe
1036	Unicorn-34128.exe
3480	Unicorn-709.exe
3680	Unicorn-34128.exe
2544	Unicorn-709.exe
4300	Unicorn-4165.exe
4736	Unicorn-33500.exe
1100	Unicorn-41114.exe
3932	Unicorn-16344.exe
4552	Unicorn-57642.exe
1640	Unicorn-18839.exe
972	Unicorn-5104.exe
2964	Unicorn-31091.exe
5012	Unicorn-21440.exe
1296	Unicorn-20123.exe
1088	Unicorn-57642.exe
1404	Unicorn-41306.exe
4336	Unicorn-45390.exe
3628	Unicorn-45390.exe
4172	Unicorn-23708.exe
4960	Unicorn-1965.exe
3952	Unicorn-8855.exe
2376	Unicorn-6796.exe
2644	Unicorn-19646.exe
4372	Unicorn-51748.exe
3004	Unicorn-60102.exe
4964	Unicorn-43766.exe
5004	Unicorn-31514.exe
1112	Unicorn-48597.exe
4688	Unicorn-4963.exe
3356	Unicorn-32260.exe
1216	Unicorn-35790.exe
392	Unicorn-33220.exe
4836	Unicorn-23538.exe
212	Unicorn-11285.exe
4156	Unicorn-57170.exe
4608	Unicorn-23538.exe
412	Unicorn-28582.exe
1004	Unicorn-33220.exe
3652	Unicorn-18367.exe
2236	Unicorn-61181.exe
1188	Unicorn-27812.exe
368	Unicorn-41580.exe
1832	Unicorn-53278.exe
3816	Unicorn-53013.exe
928	Unicorn-34895.exe
1844	Unicorn-29328.exe
3804	Unicorn-51424.exe
2204	Unicorn-4269.exe
3860	Unicorn-25074.exe
3668	Unicorn-47009.exe
4548	Unicorn-1337.exe
2536	Unicorn-50538.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 2768	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	82
PID 3280 wrote to memory of 2768	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	82
PID 3280 wrote to memory of 2768	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	82
PID 2768 wrote to memory of 1400	2768	Unicorn-25774.exe	83
PID 2768 wrote to memory of 1400	2768	Unicorn-25774.exe	83
PID 2768 wrote to memory of 1400	2768	Unicorn-25774.exe	83
PID 3280 wrote to memory of 4076	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	84
PID 3280 wrote to memory of 4076	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	84
PID 3280 wrote to memory of 4076	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	84
PID 1400 wrote to memory of 3708	1400	Unicorn-48654.exe	85
PID 1400 wrote to memory of 3708	1400	Unicorn-48654.exe	85
PID 1400 wrote to memory of 3708	1400	Unicorn-48654.exe	85
PID 4076 wrote to memory of 2816	4076	Unicorn-20620.exe	87
PID 4076 wrote to memory of 2816	4076	Unicorn-20620.exe	87
PID 4076 wrote to memory of 2816	4076	Unicorn-20620.exe	87
PID 2768 wrote to memory of 5044	2768	Unicorn-25774.exe	86
PID 2768 wrote to memory of 5044	2768	Unicorn-25774.exe	86
PID 2768 wrote to memory of 5044	2768	Unicorn-25774.exe	86
PID 3280 wrote to memory of 1456	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	88
PID 3280 wrote to memory of 1456	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	88
PID 3280 wrote to memory of 1456	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	88
PID 5044 wrote to memory of 904	5044	Unicorn-14948.exe	91
PID 5044 wrote to memory of 904	5044	Unicorn-14948.exe	91
PID 5044 wrote to memory of 904	5044	Unicorn-14948.exe	91
PID 2768 wrote to memory of 3020	2768	Unicorn-25774.exe	92
PID 2768 wrote to memory of 3020	2768	Unicorn-25774.exe	92
PID 2768 wrote to memory of 3020	2768	Unicorn-25774.exe	92
PID 1456 wrote to memory of 1612	1456	Unicorn-20515.exe	93
PID 1456 wrote to memory of 1612	1456	Unicorn-20515.exe	93
PID 1456 wrote to memory of 1612	1456	Unicorn-20515.exe	93
PID 3280 wrote to memory of 2704	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	94
PID 3280 wrote to memory of 2704	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	94
PID 3280 wrote to memory of 2704	3280	84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe	94
PID 3708 wrote to memory of 3480	3708	Unicorn-42982.exe	95
PID 3708 wrote to memory of 3480	3708	Unicorn-42982.exe	95
PID 3708 wrote to memory of 3480	3708	Unicorn-42982.exe	95
PID 2816 wrote to memory of 2544	2816	Unicorn-34814.exe	96
PID 2816 wrote to memory of 2544	2816	Unicorn-34814.exe	96
PID 2816 wrote to memory of 2544	2816	Unicorn-34814.exe	96
PID 1400 wrote to memory of 3680	1400	Unicorn-48654.exe	97
PID 1400 wrote to memory of 3680	1400	Unicorn-48654.exe	97
PID 1400 wrote to memory of 3680	1400	Unicorn-48654.exe	97
PID 4076 wrote to memory of 1036	4076	Unicorn-20620.exe	98
PID 4076 wrote to memory of 1036	4076	Unicorn-20620.exe	98
PID 4076 wrote to memory of 1036	4076	Unicorn-20620.exe	98
PID 904 wrote to memory of 4300	904	Unicorn-42318.exe	102
PID 904 wrote to memory of 4300	904	Unicorn-42318.exe	102
PID 904 wrote to memory of 4300	904	Unicorn-42318.exe	102
PID 5044 wrote to memory of 4736	5044	Unicorn-14948.exe	103
PID 5044 wrote to memory of 4736	5044	Unicorn-14948.exe	103
PID 5044 wrote to memory of 4736	5044	Unicorn-14948.exe	103
PID 3020 wrote to memory of 1100	3020	Unicorn-19851.exe	104
PID 3020 wrote to memory of 1100	3020	Unicorn-19851.exe	104
PID 3020 wrote to memory of 1100	3020	Unicorn-19851.exe	104
PID 2768 wrote to memory of 3932	2768	Unicorn-25774.exe	105
PID 2768 wrote to memory of 3932	2768	Unicorn-25774.exe	105
PID 2768 wrote to memory of 3932	2768	Unicorn-25774.exe	105
PID 1036 wrote to memory of 4552	1036	Unicorn-34128.exe	107
PID 1036 wrote to memory of 4552	1036	Unicorn-34128.exe	107
PID 1036 wrote to memory of 4552	1036	Unicorn-34128.exe	107
PID 2704 wrote to memory of 1088	2704	Unicorn-8612.exe	106
PID 2704 wrote to memory of 1088	2704	Unicorn-8612.exe	106
PID 2704 wrote to memory of 1088	2704	Unicorn-8612.exe	106
PID 3680 wrote to memory of 4336	3680	Unicorn-34128.exe	108

C:\Users\Admin\AppData\Local\Temp\84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe
"C:\Users\Admin\AppData\Local\Temp\84c0afff17b49b263cfb29e5aef7bf18cb29f20d2a53bc2d3c62509f1b2845acN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42982.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21974.exe
        10⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        10⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        10⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        9⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        9⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        9⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        9⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
        9⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20888.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        7⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        9⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        9⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53945.exe
        8⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        8⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
        7⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        6⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        8⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        8⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        7⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        7⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
        7⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57473.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        9⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-557.exe
        10⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        10⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        9⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        9⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        8⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64226.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        8⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49388.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        7⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        6⤵
        
        PID:16692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48465.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        6⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48538.exe
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
        8⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        7⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
        7⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        5⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17429.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        5⤵
        
        PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 472
        7⤵
        Program crash
        
        PID:4724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 488
        7⤵
        Program crash
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        6⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41580.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26914.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        8⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        8⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20888.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        7⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        6⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22446.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18981.exe
        7⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        6⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        6⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39608.exe
        5⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34558.exe
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        8⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        8⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63385.exe
        8⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27556.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        6⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        6⤵
        
        PID:732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        6⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3095.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        6⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        7⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38332.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        6⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        6⤵
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
        6⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11271.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
      4⤵
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe
      4⤵
      PID:14624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        9⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        10⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        10⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        10⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        9⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        9⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        8⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        8⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        9⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        9⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        7⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        9⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        9⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        8⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        8⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61854.exe
        8⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        8⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        7⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        7⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
        7⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54408.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
        6⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        9⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64152.exe
        9⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        8⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        8⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        6⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        7⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        6⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
        6⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        5⤵
        Executes dropped EXE
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        8⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        7⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        6⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56956.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17429.exe
        5⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8792.exe
        8⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5160.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        7⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        7⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4459.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        6⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        5⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33384.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        7⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        7⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40820.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3681.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
        7⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        6⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        5⤵
        
        PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        5⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        7⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        6⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10584.exe
      4⤵
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        6⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
      4⤵
      PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
      4⤵
      PID:15052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31514.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        6⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        8⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        8⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11184.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        7⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        7⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        7⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8740.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        6⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        6⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        6⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        5⤵
        
        PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10193.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56042.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        7⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        6⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        5⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        6⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
        5⤵
        
        PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        5⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        5⤵
        
        PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
      4⤵
      PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45326.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        5⤵
        
        PID:12760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
      4⤵
      PID:15208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        5⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        8⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        7⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        6⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30142.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11052.exe
        7⤵
        
        PID:180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        6⤵
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        6⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        6⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
      4⤵
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21132.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        5⤵
        
        PID:13256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        5⤵
        
        PID:17288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        5⤵
        
        PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-364.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
      4⤵
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        6⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        5⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        5⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        5⤵
        
        PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34890.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        5⤵
        
        PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
      4⤵
      PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe
      4⤵
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      4⤵
      PID:15224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      4⤵
      PID:16552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
    3⤵
    PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
      4⤵
      PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
      4⤵
      PID:8204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
    3⤵
    PID:8248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
    3⤵
    PID:11680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
    3⤵
    PID:16516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20620.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        9⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        9⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        9⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        8⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3681.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        7⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        7⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        8⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
        8⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        7⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        6⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
        5⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        6⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        7⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        6⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        5⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        6⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        6⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        8⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        7⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        6⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        6⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
        5⤵
        
        PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        5⤵
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21974.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        7⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        7⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-276.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        5⤵
        
        PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        6⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34291.exe
        5⤵
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
        5⤵
        
        PID:17268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe
        5⤵
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
        5⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        5⤵
        
        PID:17660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42458.exe
      4⤵
      PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        6⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        9⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        9⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        7⤵
        
        PID:13368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        7⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        7⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        6⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        7⤵
        
        PID:15816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
        6⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        5⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23112.exe
        8⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        7⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        7⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
        6⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        7⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42656.exe
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        6⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
        5⤵
        
        PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-635.exe
      4⤵
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        5⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        6⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19689.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
      4⤵
      PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34778.exe
        5⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29454.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        7⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        6⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        6⤵
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
        6⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        5⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        5⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
      4⤵
      PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
        5⤵
        
        PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exe
      4⤵
      PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
      4⤵
      PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        5⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        5⤵
        
        PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9071.exe
      4⤵
      PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
      4⤵
      PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
      4⤵
      PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
    3⤵
    PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
      4⤵
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
      4⤵
      PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
      4⤵
      PID:15576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
    3⤵
    PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
      4⤵
      PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
      4⤵
      PID:652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
    3⤵
    PID:11196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
    3⤵
    PID:15120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
    3⤵
    PID:5992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        8⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe
        8⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        8⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        7⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        7⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        7⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        7⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55864.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
        5⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        6⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        5⤵
        
        PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        6⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        5⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
        6⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        5⤵
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3154.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
      4⤵
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26914.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        5⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        5⤵
        
        PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      4⤵
      PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44412.exe
        5⤵
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
      4⤵
      PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      4⤵
      PID:14976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4459.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42476.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        7⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37276.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        6⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        5⤵
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        5⤵
        
        PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
      4⤵
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
    3⤵
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4565.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        5⤵
        
        PID:15848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
      4⤵
      PID:15344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
      4⤵
      PID:10840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
      4⤵
      PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53482.exe
      4⤵
      PID:16340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
    3⤵
    PID:8264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39614.exe
    3⤵
    PID:10852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
    3⤵
    PID:16668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
    3⤵
    PID:12524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
        6⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        7⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33524.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44728.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        6⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9204.exe
      4⤵
      PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18069.exe
        5⤵
        
        PID:12680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
      4⤵
      PID:12160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
      4⤵
      PID:15236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
      4⤵
      PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
      4⤵
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        6⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59949.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        5⤵
        
        PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
      4⤵
      PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
    3⤵
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        5⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        5⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
      4⤵
      PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
      4⤵
      PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
      4⤵
      PID:16824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
      4⤵
      PID:11896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe
      4⤵
      PID:16020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
      4⤵
      PID:11176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
    3⤵
    PID:10076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
    3⤵
    PID:12804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
    3⤵
    PID:5796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9263.exe
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
      4⤵
      PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        5⤵
        
        PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
      4⤵
      PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
      4⤵
      PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
    3⤵
    PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exe
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
      4⤵
      PID:12852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
    3⤵
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36108.exe
    3⤵
    PID:12004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
    3⤵
    PID:3028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
    3⤵
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18443.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
      4⤵
      PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
      4⤵
      PID:13024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
    3⤵
    PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
      4⤵
      PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5964.exe
      4⤵
      PID:16488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
    3⤵
    PID:9880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
    3⤵
    PID:14220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exe
    3⤵
    PID:5912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
  2⤵
  PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
    3⤵
    PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
      4⤵
      PID:14036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
    3⤵
    PID:9648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
    3⤵
    PID:13952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42581.exe
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
    3⤵
    PID:16848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
  2⤵
  PID:7776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
  2⤵
  PID:11124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
  2⤵
  PID:15012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 412 -ip 412
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 412 -ip 412
1⤵
PID:2780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-12961.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
Size 468KB
SHA256 3db4fa9c2ae0ff48975836ec1a8d8983d1ffe1210b9aa996696a77866ff3443c
MD5 697b03556168fe7ae7688cc983e53a29
SHA1 c0772e4d82616094bb183ed38057e8828d004264
SHA512 ab703eb171fd3c45a14d1309a242a9ffd893ade893bbb5d8f3d8ad60f56e00bb5c0bb528c5f22b825a496d104397979ead501f53aab873b99efbc73f0656d0c8
SSDEEP 3072:1buUogIuIw5UCbY6Hzwjrf8/EoOC3lpC6FH04VPTwapkiC8zdsef:1bJo3gUClHkjrfkj+kwaeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-14948.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
Size 468KB
SHA256 613cbb92933e563fc9083dc28edd39ca305ddb85af9e1292db8cff8cf7e0727c
MD5 b7669a8635e08d883be744fd2bf461e5
SHA1 420ebc119757c972f65f2a4b0b1518360731d895
SHA512 1c624793d58fb93a8f3a3b17a8a7311b5d695b6e15f4120388d9f89033141d696bc1672370eab8f224e1bcf2d55456e0a37d3714c085fff590ec058dcbffa1fe
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwapkGC8zdsef:1bJo3gUr4Hkjrfkj+/wael8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16344.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
Size 468KB
SHA256 d0aea4522c27e33e4d38dfeeb80e1896fe79e9a1c362bc23a4bae551aaf29294
MD5 6640885447d419fbec435f794e9b3945
SHA1 5a35d3b018ab9adb71e0ec639469b518a9d5d9b5
SHA512 d37faaccbaca7fe49055b6d996b83c7716d92720d479a29ce46dd154123226937853aa58a0bcb34b979a9a9a093bd4444db1fce2a748c4402094cf23803b0565
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTVapkiC8zdsef:1bJo3gUr4Hkjrfkj+/VaeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-18839.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
Size 468KB
SHA256 22085189932dcdd8429c1410b08364e0b676fc8be0e8fcf26c9c6744cc0f0c57
MD5 c5d1614d80f8ef149d7aaa8e9731d49d
SHA1 4a8fc23ed8cd3484599d20e51ee7b63de872036b
SHA512 ebc0bfff43b59c4b0e9f9e62758e474f9db6936e336a285a5cb65dd0a1c108c4bf5f04e2712cfb479ea259316c5813b0c618d74ab8df4fcd449233990104b8af
SSDEEP 3072:1buUogIuIw5frbYXHzwjrf8/EoOC3lpC6FH0hVPTwapkiP8zdsef:1bJo3gfr4Hkjrfkj+/wae48zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-1965.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
Size 468KB
SHA256 1c88963c707cdfbc435eef63423145e997c9ea365c08109663380c2910ba7874
MD5 6d0f96c4f955462c019399edcb2ec6fc
SHA1 0e45ff250cc25f95c08d8beb1152aa40ec1ccf41
SHA512 2ce266e5ca6eca006b60e84e639a73cb739d4e5340ad7ffff6cfa72b1d48a082faa9ce357c2f7a3741923efc26602918617c111f011aaca1e6d9ed5313386b4a
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwaxkGC8zdsev:1bJo3gUr4Hkjrfkj+/wa2l8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19851.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
Size 468KB
SHA256 e076a2b5714ff94d2831683c5bf07e721a1f29b434f59dd64f3a1b5b239cacc6
MD5 d0131291252cf975267e686d7b3a8481
SHA1 f87d62be58315f5042eed286cb56c0c9cc419905
SHA512 3653aad00e250786412dc337dc3a192adb1f8db9bc2dd98b0cfd53ea5ee4f10d1f9ccb18c87a9294be24580b9026223fe3dc48c34905d8a69c81bfda0ebf246c
SSDEEP 3072:1buUogIuIw5UrbY7Hzwjrf8/EoOC3lpC6FH0hVPTwapkiC8zdsef:1bJo3gUrsHkjrfkj+/waeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20123.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
Size 468KB
SHA256 d66fb0f546e6e9c6d6ed716b0ca5e90192006043377d65846c5964e4652207b3
MD5 43692a47ae5b9ed3e9fc62d2f5edf41e
SHA1 6643f9173103c796b9b25932fcaad7b49886734f
SHA512 8ace43ef2590527ee92c98f0d515e3ba80651f4f4b6513fa655d7d9904b679a68ab2be0e49c02477b411dfd5c1841497a3951897c33048ca41b533abb44f9dfe
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6HH04VPTwapkiC8zdsef:1bJo3gUr4HkjrfkjokwaeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20515.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
Size 468KB
SHA256 b9750bf1bc8aa24c3dd452959268118cf01a7cc91a54ac6186de767c0eecf0e9
MD5 1b633372112caa222d3395d7eec6a61e
SHA1 24affa4e673f341e8c04a367934f42af32fdb1be
SHA512 d23097230a77461066435665f0e7b12bb61934ecfe7501d9eb1731c6e0313e87c8c3a1e5cf4e184c52d31186594de0278dff236f78704661a6b44f8fc5051870
SSDEEP 3072:1buUogIuIw5UrbY6Hzwjrf8/EoOC3lpC6FH04VPTwapkiC8zdsef:1bJo3gUrlHkjrfkj+kwaeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20620.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20620.exe
Size 468KB
SHA256 de28e469e05322df51c5a1f31138d1588fd62bd606b095c144bd53d4ee583a4d
MD5 58f25bc5b73eef762d8d98f56ad99178
SHA1 2167065ab9030fafa37b1d6ebdbb90bb670598fd
SHA512 81128c1ad151d0db664e8901e76bc8b305d87a3151ddef3637c08ab48eea94179cfd5dfd1ecc85d3ec4715ec557bb435e053ab7367b76fcf907a2b852a0a0f73
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH04VPTwapkiCnzdsef:1bJo3gUr4Hkjrfkj+kwaeJnzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21440.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
Size 468KB
SHA256 25b357e3b084af1a2c580960e92eb4f633e0522aa90ed6fe2d11b451a7ab052a
MD5 ee7fdb022ea211866d6e0b8cf6420fb2
SHA1 eba8dcb158a20061ceeae5934b0c26ced700fa1d
SHA512 0ee7174994ff3581d2f0e0073c4888ceec9a9f84e21d0d0ae120964370532936e72a166350bf74df48c556b3648d6a3e6095e06451636b3df21ae66ed9ef0cf7
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwa1kiPVzdsef:1bJo3gUr4Hkjrfkj+/wa64Vzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23708.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
Size 468KB
SHA256 d34e671faf19006248f82a24244ebc187c78f7350946761443c1aa21eacd8ca4
MD5 6f8b0daf173ea85e6a5c29e99dc879a2
SHA1 c3e8293f47f675180c4d1988c5fb5356ddc9e98b
SHA512 8f87a66284df2c0697965040a303ed2ce317721d810392c7c3592a3bb93566d46b468e25dffb8b8505a19e81b4cf34425b5a3e8d7fee882ac85cca1d4f404583
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwa1kiP9zdsej:1bJo3gUr4Hkjrfkj+/wa649zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25774.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
Size 468KB
SHA256 4ab5800084ec63b90bc56523e2b4a84e0697a30d8ca08b7421a421b876294d46
MD5 e72c9669c067eeeedaa11cac1d8898ab
SHA1 a79787c90238d3b605682e4ea975c3c5d58f5f73
SHA512 5cd78471b1318616d73f573fcb36939164b4c05df4eecdaf6ae87a5acee91fe526763e3764603f97b57e303e5011b03f17697910b404e1ea9869f68f3cfbf3d0
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwapkiC8zdsef:1bJo3gUr4Hkjrfkj+/waeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31091.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
Size 468KB
SHA256 f1ac878a6cab5124907a50db3d775c138f42674f8e02eb36ac60a05240caa2ab
MD5 41801310f9bb33bc7609f797cfc7002f
SHA1 4c3d82f0c87a334337f377da0b35a95bcf8e2b7a
SHA512 c6e01abaf483b0dd77674f480f574cf6b1ac7282b84e630d7f0eb577a33e173db43b3d3aeb25504c4a19f581305f35b6d2ec3efc4f9a4a2fd6f61818fda09088
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6IH04VPTwapkiCnzdsef:1bJo3gUr4HkjrfkjtkwaeJnzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33500.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
Size 468KB
SHA256 f5ae9052edb27d1ddbd3b00f2e0ed48e819cf5a79009d3959c702036c8721473
MD5 4a5b8d1e45e7bd7edb9bc435007c2abf
SHA1 5793ed48eb6de982db0dc67f72a4e2a8a1f27953
SHA512 cab439fc5a6405db304cc2c22aeef9abaf4559d3f0c60eb587f597b8effedbd6f67401063051a9d7c4ff088554e9e75e74ab72493435d07a2e6e554809bd0cf4
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwapkGC8zdse5:1bJo3gUr4Hkjrfkj+/wael8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34128.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
Size 468KB
SHA256 a369c2266c4fa291ce7562bcd4f73afddd4463b75eabf58ec15c312b24fc4890
MD5 616a0bd6598739bd648bcfe71e70151f
SHA1 011ffa882bddd060b0a679da4bfcfb4aa5ec4079
SHA512 62a0a65d19690335bc2d32fb7777fa9be9f5884d063c917b04da72216a9c07d9872b79a9691741cdb1ba22baff4494ecc5b946c3b8abd11f109bb93f58dc0b8e
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwapkiP8zdseE:1bJo3gUr4Hkjrfkj+/wae48zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34814.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
Size 468KB
SHA256 ba3ee74c732692415bcdc2ed344f04c81c65a79b24bad9fcdac4b3a1e709f16f
MD5 f998d8eed88201e6b1cdfc4b8082d8cd
SHA1 603be97a320470bedd7f731fa687b50e1503dcea
SHA512 4084f363ddede6bf3bab7545d34ab8685fb8b5cf82b121f9a2a3a84fc876bbce0f054af65957c4c5ba9c6734ec03fa655dc2ac316050ecdf46800e2b1ca2420e
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH04VPTAapkiCnzdsef:1bJo3gUr4Hkjrfkj+kAaeJnzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41114.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
Size 468KB
SHA256 3d5a73b2f1b844fd839ad1e9590ae823df062f8ba2dbc0b9747bea7a30fe0c99
MD5 80cd85b62dc34f82d0a028f80530e64a
SHA1 2e545aeffeff2cceb5f963e0208ec6ff94ef17cf
SHA512 65385bca59300408c7439e69caa8176ff1a76492b06aa0d990a37762f8532f2f349ab9f536d6e34f41a47d790681d4bd976224221c35e7a38e8381dc27a52753
SSDEEP 3072:1buUogIuIw5UrbY7Hzwjrf8/EoOC3lpC6FH0hVPTwaakiC8zdsef:1bJo3gUrsHkjrfkj+/wazJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41306.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
Size 468KB
SHA256 df78e0b60046279d3e916b3001a0f90914be2642b9de91b2f64d31efa61b4823
MD5 a2060ffed46bfaebe64db7bb5c7aa098
SHA1 d8400b3dcccd95a183c269fb332a03e74c78669a
SHA512 c451a6bb7f8e8ecfc5a27587bd362a98586442e1f79ac2ea8b0fe98219a178efc0e29c54d5407e45a036c61f2f4e14986f73e60f67d1bb251f181768e4689ad6
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwaqkiP8zdsej:1bJo3gUr4Hkjrfkj+/waD48zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-4165.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
Size 468KB
SHA256 f6b82739369f1492d1022f94e2bf00f1271cdc50c253c3ec4ffe86898db7db2a
MD5 6fbb3556cb04a5cc8f41969e598b128c
SHA1 dad93617b2ad4ce9ba8c3220c396db708089fa22
SHA512 929db2353d9a4b55e5eba3353d0c3e0e15266c5f4d31d6bf42af70b4841ad33956ee4dab6c93b09337c3ec63ac1a347d90261a1b2953cd79efdbdce9b6bfd9b9
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwaxkGC8zdseX:1bJo3gUr4Hkjrfkj+/wa2l8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42038.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
Size 468KB
SHA256 485994dff62b1933a76f58453e8f6ecd9fac68a5a8232d281a385ff8f36179a2
MD5 f5d2cf98ab0a91dc23e9782837b6390c
SHA1 23ba13290f49decb0220298e10f3f1ac2d4a8509
SHA512 fb221c337103858a96f3ee5b260a04d2f08c654e82e816a8f04094f1dc07994cce1971a2b27db98aa1478d61ff6a5042f62cf0fe0529babf0100f3b46629ddd6
SSDEEP 3072:zbuUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwFpkiP8zdseO:zbJo3gUr4Hkjrfkj+/wFe48zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42318.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
Size 468KB
SHA256 e83bb53ae83f63b989c3b93091aa70a9b0a9ae867aaac9905751007026af9317
MD5 a24fd590f3c0f573926d18ccc66f6e28
SHA1 7b4ea2176ad1f5b6d1ae11abbfe75e112e49242b
SHA512 ed9a0e45d03324bd66308c6609fe4ae5595fd41b35a4dcd95402012fb20521260820eeb870474cb5dadaf50f910ca1a1e823b179f13de4b994e992cd30d8c56a
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwaxkGC8zdsef:1bJo3gUr4Hkjrfkj+/wa2l8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42982.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42982.exe
Size 468KB
SHA256 9d87838e0dcf637e67211f2fccd68f552e1d7708fa9b95d7013a5b99c6cb35c5
MD5 46f83be55746ecb8b4290f2283db962e
SHA1 dd7bc97090ce794a8e4ae74f11dcf48847e43bc4
SHA512 9d6bad5ca7ed5caad4d007af6caeba7d9a9f42869262008f754c1380a824e87d980e0f1ae2f4a0db44571b8fa7f20021f1be302c085e29ae8a06fa267ff8c51d
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwa1kiP8zdsef:1bJo3gUr4Hkjrfkj+/wa648zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45390.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
Size 468KB
SHA256 9feb19b9d900ceaeda9a1788536c209e6e723c3429690c0b6ce52138104c5757
MD5 bac51613b253b7d03e1fa6333f945ccf
SHA1 b16e166a16e802e750a6192db26cee3c76254f34
SHA512 0ea5c3c8d684a5daf236f85c1314ff01dfefac1b5c052d2ee2c71b3e0360dd283af4f244043d0bd3bb69d4efda408045c78b2eca057e7b1ef6cf0835a29249e8
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwapk0P8zdseE:1bJo3gUr4Hkjrfkj+/waeS8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48654.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
Size 468KB
SHA256 375d8ef19ab5e0d7fdfabcff2f39c85c3e4230e373e62be8f5ed3274238bbada
MD5 f4340869ee15868c4f573fa39d55537c
SHA1 1a82991d351a3a5e906f4cd8888a4d8aa0dcf3e6
SHA512 4acf07ee8080ff7e12706c64226dff31336b2d8944fe61cf75f4a16d86e07fc184530b8073080fe0557ba806f42b46e2526c66683abd70c8f4c0224f75a2fa11
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwapkiP8zdsef:1bJo3gUr4Hkjrfkj+/wae48zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5104.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
Size 468KB
SHA256 b52cf27a43bf8fde5244ef7c494cc4c22c7f3b1dff74c1afc6c98b34a7fdc0b9
MD5 4a6034b9602774f1cd53f1e56cdc62dc
SHA1 d25ef4f129308e3dbd09555dad1ccf5200d33696
SHA512 a61c8d41efbffa44826ec0556b8a88e1e6cf869360bcb8d2ad84392ffef68d7a2f4a2937ca1b0781fa02b072f3d6bc114e9cb479ea41738e9a3adbe27cbdbf18
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH04VPTaapkiCnzdsef:1bJo3gUr4Hkjrfkj+kaaeJnzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57642.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
Size 468KB
SHA256 933d8841e535eeb13f43c32557a53ddc831ca680d97c76b27a83956e40629e40
MD5 205e05f6e10441cdfb26b27d2089c972
SHA1 2050ea50195db112da92136b3a8302638bfbe719
SHA512 da66a834d6157b7f5b80f42de0065ec532c25ef8bbbff1aced19c0b40eaecdffc50efd9edc629436444c6e0d85ac41ed97a8368177964a36348c2dce69200fd7
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH04VtTwapkiC8zYsef:1bJo3gUr4Hkjrfkj+GwaeJ8zY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61021.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
Size 468KB
SHA256 599ff67af2232381822524995195d80fa7411ce29d628752f234ff23e1a44c91
MD5 970f14a6c678a1be0dad4eb0c4907552
SHA1 acb70e77d760b35af6d476a011fe1cab2a12b627
SHA512 05e379cd2dc472bd38540c740a53c47d25d332276f684b3ea85d86dffe3a3e53fb1eae8f08ebe84eab0d97f104a96900879f870bfc0438f4ba204fdbc8942ea6
SSDEEP 3072:UbuUogIuIw5UrbYXHzBjrf8/EoOC3lpC6FH04VPTwapkiU8zdsef:UbJo3gUr4H1jrfkj+kwaer8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6796.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
Size 468KB
SHA256 9137545dad45e89d5fc646d2f31b1140c1225593978d5f47929a98e29c674c3e
MD5 94d3a69dba853df4e53379022efcdf92
SHA1 8cab07f764d35bce49186d4baa577aeffefb8f0f
SHA512 29945206b4910c3036d75c2d9d3662f59ef630dedbe9b9f7ac42cc2557b302b8bdb3fdfa30c495c4298fb52e01970043271963a570dd53d4ce5252e68d0bc1f5
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwwxkGC8zdsef:1bJo3gUr4Hkjrfkj+/ww2l8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-709.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
Size 468KB
SHA256 b9e9bbd511d05050aa6f164d101f4705e43cd32ec91fe5abd9cba57e1bda9cc3
MD5 f028b779c4ecc17bd0e22bf6edb5bc7d
SHA1 e2e4d54af4c9d836b9a5c71803bf27f170d5748b
SHA512 7c3e63b0d94c39df12326a96ca20a97f281e8c3c4d21ef4dbc731780350c200f45ae0a7a71e374734a8ccb965f83b3247d39321649b8ff67320f0aaf9a798c52
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH0hVPTwa1kiP8zdsej:1bJo3gUr4Hkjrfkj+/wa648zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8612.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
Size 468KB
SHA256 88f4df9d848c03847d2ea046622f201e92bdcd72e52c8c28849f8806c6214e10
MD5 2db5e2207c442b10b90d4b2c5a492308
SHA1 83066113c4927f991d60a04d7cd02f26f3b529d8
SHA512 2b997f0714500a0f565e8e43c60da1cde09b81212b72e9e85db5f869e8002a3ebd48158f63e11892cb955ab840162dd5069d778f2a5d3eff779c314018847153
SSDEEP 3072:1buUogIuIw5UrbYXHzwjrf8/EoOC3lpC6FH04VtTwapkiC8zdsef:1bJo3gUr4Hkjrfkj+GwaeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8855.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
Size 468KB
SHA256 f940d475c82a067c04fdec7b8907834cc186e4d6110b579e8e7b28a48e9b53e6
MD5 d71d4d1cf8034b2a81775e291c03aed2
SHA1 2816e9cce35a443bc4de6db9f6f1fb359c24c815
SHA512 0a773fa5a35191c029382c87079dd893606c9fd6449e7e725323bd362cba521b6a33e721d39ee8e9dbfc9423236be390591887b08dc850bcbb2df481c641ffc6
SSDEEP 3072:1buUogIuIw5UrbY6Hzwjrf8/EoOC3lpC6FH04VPTwapkiC8zdseD:1bJo3gUrlHkjrfkj+kwaeJ8zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads